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5 BACKGROUND 



Field Of The Invention 

The present invention relates to the field of data processing. More specifically, 
embodiments of the present invention relate to a computer implemented method and 
10 system for verifying and tracking sources of unsolicited electronic messages. 



Related Art 

Electroruc systems and circuits have made a significant contribution towards the 
advancement of modem society and are utilized in a number of applications to achieve 

15 advantageous results. Numerous electronic technologies such as digital computers, 
calculators, audio devices, video equipment, and telephone systems have facilitated 
increased productivity and reduced costs in analyzing and commimicating data in most 
areas of business, science, education and entertairmient. These advantageous results are 
often realized through networked devices that enable information to be commimicated 

20 between the devices. As organizations and individuals utilize increasingly distributed 
and open commuiucation environments, the use of electroruc messaging has increased 
substantially and become an important method of commimication for many individuals 
and organizations. However, a nimiber of organizations and individuals forward 
imsolicited messages addressed to recipients that have no desire to read the messages. 

25 
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Electroiuc messaging, including electronic mail (e-mail) messages, provides a 
convenient and easy means for two or more individuals to communicate information in 
-text messages, pictures,-or almost any electroruc file.. Some organizations use electronic , 
messaging as a bulk communication mechanism for distributing information to a mass 

5 audience. These messages are often unsolicited, unwanted and often referred to as 

"spam". Spam activity can be extremely high and cover a wide variety of subjects. Given 
the diversity of subjects and the unsolicited nature of spam, most recipients have no 
desire to receive or read most of the spam messages. Further aggravating the situation is 
the large number of spam initiators and the fact that any given initiator may forward 

10 multiple messages. The large volume of messages usually produces a number of 
inconveniences for the recipients. 

The typical high volume of e-mail messages usually requires a significant 
expenditure of resources to deal with the e-mails. Most e-mail messages are stored by 
15 default in a single electroiuc mailbox or folder until the recipient of the e-mail processes 
them individually. When the ntunber of incoming messages is very large, the process of 
manually determining an appropriate action (e.g., opening or deleting an e-mail) 
consumes significant time and resources. Expending the time and resources on dealing 
with imwanted messages is usually wasteful and very aggravating. 

20 

In addition to being aggravating, commimicating junk mail and spam usually 
occupy valuable commuiucatibn resources. The amoimt of bandwidth that can be 
communicated on any given system at a particular time is usually linuted. If a system is 
inimdated with numerous spam and jimk mail messages it can delay the communication 
25 of other important messages and adversely impact other processes. 
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Spam initiators have typically found ways to overcome or side step traditional 

attempts at preventing "spam" messages. Some traditionalermail applications may 

attempt to have a recipient identify a message as spam and block future messages from 
5 the same address. This preventive measure has typically been easily overcome by spam 
initiators using misleading source identifications. For example, a spam initiator caii 
include an. erroneous of fake source internet protocol (IP) address as a source address in a 
commimication header packet header. The task of accurately identifying sources of spam 
messages is even more difficult v^hen a spam message includes a forged or "spoofed'' 
10 address of a reputable host source and includes the address of the reputable source in the 
header of the spam e-mail. 
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SUMMARY OF THE INVENTION 



, system for providing an efficient and convenient mechanism for tracking identification of 
5 imsolicited electronic message (e.g., e-mails) sources is presented. In one embodiment of 
the present invention, a request for authorization to forward an electronic message is 
received. The request for authorization includes a request source address. A response 
including an authorization indicator is sent to the source address of the request for 
authorization. The authorization indicator can be a special (e.g. unique) bit string. An 

10 electronic message is received and a determination is made if the electronic message 
includes a valid authorization indictor. If the electronic message does include a valid 
authorization indicator the electronic message is associated with the request source 
address and the association is tracked. In one exemplary implementation, at source 
address included in the electronic message is compared to the request source address and 

15 discrepancies are noted. The special nature (e.g., uiuqueness) of the authorization bit 
string indicates that the string passed through the request source (e.g., IP address) it.was 
forwarded to. Since the e-mail passed through the request source (e.g., IP address) it 
provides an indication that the user at the request source or address is involved in the 
propagation of the electronic message. Having a reliable means of identifying a source 

20, address which is involved in the propagation of the electronic message permits 

accountability and responsibility for propagating the electronic message to be assigned to 
the verified source address. 
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BRIEF DESCRIFnON OF THE DRAWINGS 



The accompanying drawings, which are incorporated in and form a part of this 

specification, illustrate embodiments of the invention and, together with the description, 
5 serve to explain the principles of the invention. 



Figure 1 is a flow chart of xmsolicited electronic message source tracking method 
100 in accordance with one embodiment of the present invention. 

10 Figure 2 is a flow chart of xmsolicited e-mail iiitemet protocol source address 

verification method 200 in accordance with one embodiment of the present invention. 

Figure 3A is a block diagram of one embodiment of a computer system on which 
the present invention can be implemented, 

15 

Figure 3B is a block diagram an (exemplary communication network in accordance 
with one embodiment of the present invention. 

Figure 4 is a flow chart of an unsolicited electronic message irutiation tracking 
20 metiiod in accordance with one embodiment of the present invention: 
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DETAILED DESCRIPTION OF THE INVENTION 



Reference will now be made in detail.to the preferred embodiments of the 

invention, examples of which are illustrated in the accompanying drawings. While the 
invention will be described in conjimction with the preferred embodiments, it will be 
understood that they are not intended to limit the invention to these embodiments. On 
the contrary, the invention is intended to cover alternatives, modifications and 
equivalents, which may be included within the spirit and scope of the invention as 
defined by the appended claims. Furthermore, in the following detailed description of the 
present invention, numerous specific details are set forth in order to provide a thorough 
understanding of the present invention. However, it will be obvious to one of ordinary 
skill in the art that the present invention may be practiced without these specific details. 
In other instances, well known methods, procedures, components, and circuits have not 
been described in detail as not to imnecessarily obscure aspects of the present invention. 

Some portions of the detailed descriptions that follow are presented in terms of 
procedures, logic blocks, processing, and other symbolic representations of operations on 
data bits within a computer memory. These descriptions and representations are the 
means used by those skilled in the data processing arts to most effectively convey the 
substance of their work to others skilled in the art. A procedure, logic block, process, etc., 
is here, and generally, conceived to be a self-consistent sequence of steps or instructions 
leading to a desired result. The steps are those requiring physical manipulations of 
physical quantities. Usually, though not necessarily, these quantities take the form of 
electrical or magnetic signals capable of being stored, transferred, combined, compared, 
and otherwise manipulated in a computer system. It has proven converuent at times, 
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principally for reasons of common usage, to refer to these signals as bits, bytes, values, 
elements, symbols, characters, terms, numbers, or the like. 

It should be bome in mind, however, that all of these and similar terms are to be 
5 associated with the appropriate physical quantities and are merely convenient labels 
applied to these quantities. Unless specifically stated otherwise as apparent from the 

t 

following discussions, it is appreciated that throughout the present invention, discussions 
utilizing terms such as "setting," "storing," "scanning," "receiving," "sending," 
"disregarding," "entering," or the like, refer to the action, and processes of a computer 

10 system or similar intelligent electronic computing device, that manipulates and 

transforms data represented as physical (electronic) quantities within the computer 
system's registers and memories into other data similarly represented as physical 
quantities within the computer system memories or registers or other such information 
storage, transmission or display devices. 

15 . V 

A present invention imsolicited e-mail source Verification and tracking method and 
system provides an efficient and convenient accountability tracking mechanism for 
unsolicited electronic messages (e.g., e-mails) propagators (e.g., spam initiators). An 
unsolicited e-mail verification and tracking system and method provides an unauthorized 

20 electronic messages origination source indication. The system arid method provides 
verification of the source identification and facilitates detection of forged and/or 
"cloaked" source identification indicators (e.g., a source IP address). The xmsolicited e- 
mail verification and tracking system and method cai\ also facilitate the policing of 
network traffic and C2in assist "spam" deterrence programs by assigning accoimtability for 

25 generating the unwanted messages. 
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Figure 1 is a flow chart of unsolicited electronic message source tracking method 
100 in accordance with one embodiment of the present invention. Unsolicited electronic 
message source tracking method 100 provides electronic message source identification 
5 verification and tracking. Electronic message source identifications are tracked and 
electronic messages without valid authorization and/or source identification are noted. 

In step 110, a verification indication is obtained. In one embodiment of the present 
invention, an originator or source of an electronic message (e.g., e-mail) transmits a 

10 request-to-send the electronic message. For example, the request-to-send can be sent to a 
simple mail trai\sfer protocol (SMTP) agent supporting e-mail service for ain end use 
destination. The request-to-send includes an indication of the sender's or source 
identification (e.g., an internet protocol (IP) address). If the sender provided a valid 
source identification (e.g., IP address) the request sender (e.g., source of the request-to- 

15 send) receives a response with a verification indicator (e.g., a special or unique 

authorization bit string). For example, an SMTP agent forwards a verification indicator to 
the request sender or source attempting to forward an imsolicited e-mail. 

In step 120, the source of an imsolicited electronic message (e.g., e-mail) forwards 
20 the electronic message including the verification indicator (e.g., a special or imique 

authorization bit string). For example, a special authorization bit string can be included in 
the header of an e-mail message. The special nature (e.g., uniqueness) of the 
authorization bit string indicates that the string passed through the source (e.g., DP 
address) it was forwarded to in step 110. Since the e-mail passed through the source (e.g:, 
25 IP address) it provides an indication that the user at the source or address is involved in 
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the origination of the electronic message. In one embodiment, an actual e-mail message 
also includes a source address (e.g., also included in the header). The source address 
- included in-the e-mail message header can be compared to the soxyrce address the 
verification indicator was sent to in step 110 to identify and track discrepancies. 

5 

Figure 2 is a flow chart of unsolicited e-mail internet protocol (BP) source address 
verification method 200 in accordance with one embodiment of the present invention. 
Unsolicited e-mail IP source address verification method 200 tracks accoimtability for 
forwarding e-mail messages. A special (e.g., imique) authorization string is generated by 
10 imsolicited e-mail IP source address verification method 200 and "associated" with a 
sender's address. The combined uniqueness of the authorization string and the 
association with a particular source address provides an accoimtability tracking 
mechanism. 

15 In step 210, a request for authorization to forward an electronic mail (e-mail) 

message is received. In one exemplary implementation, the request is initiated by the 
source originating or forwarding the e-mail message. The request asks for permission or 
authorization to send an e-mail message to a particular destination (e.g., an internet 
service provider (ISP) customer). In one embodiment of the present invention, the request 

20 is sent to an intermediate network resource (e.g., ISP resources, an intermediate SMTP 
agent, etc.) en route to a different ultimate destination (e.g., end user). The request also 
includes an address of the reqiiest source. 



25 



In step 220, an authorization response is sent. In one exemplary implementation, 
the authorization response includes an authorization indicator. The authorization 
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indicator indicates that the request source is authorized to forward an e-mail message. 
The authorization response is sent to the same initiation or source address identified in 
the request of step 210. If the request does not include^ an initiation address the 
communication is terminated. In one embodiment of the present invention, an 
5 authorization indication generator process is performed in which the authorization 

indicator is generated. In one exemplary implementation, the authorization indicator is a 
special (e.g., imique) sequence of bits. The sequence of bits can correspond to a variety of 
items. For example, the sequence of bits can correspond to a key. Alternatively, the 
sequence of bits can be encoded. 

10 

The authorization indicator is forwarded to the source identified in the request. In 
one exemplary implementation, the request source address is extracted or parsed from a 
header in a commimication package received in step 210. The extracted address is then 
utilized as a destination address in a header file of a return or response package with the - 
15 authorization information (e.g., unique bit string). 

. A received e-mail message is handled in step 230. In one embodiment of the 
present invention, the source address included in the received e-mail message is 
compared to the address the authorization indicator was sent to. In one exemplary 
20 implementation, the intermediate network resource (e.g., ISP resources, an intermediate 
SMTP agent, etc.) inserts an entry into the e-mail message indicating the address the 
authorization was sent to before forwarding the e-mail message on towards its final end 
use destination. 
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In one embodiment of the present invention, step 230 includes identifying received 
e-mail for "Spam". For example, a user reviews the e-mail and marks it as including 
"Spam". The sender of the "Spam" is jdentified by reviewing the source identification 
(e.g., IP address) to which the authorization was sent. 

5 

In one embodiment of the present invention, the request is part of commimication 
initialization ("handshaking") protocol to establish a commimication link. When trying to 
setup a connection, a source device send pieces of information called packets with a 
request to set up a connection with a destination device. The destination device sends a 

10 packet back indicating a communication link can be established. A variety of protocol 
issues can be resolved (e.g., the type of port, messages, etc.). For example, the destination 
device can indicate that commuiucations are to be addressed to a particular port on the 
destination device. In one exemplary implementation, the authorization request and 
response (e.g., an authorization indicator) is included in the handshaking packets going 

15 back and forth between the source and destination. 

In one embodiment of the present invention, including a valid authorization or 
verification indicator in an e-mail header is optional. For example, if a legacy system is 
not equipped or programmed to participate in unsolicited e-mail intemet protocol (IP) 

20 source address verification method 200, then an STMP agent can optionally permit the e- 
mail transmission to proceed without obtaining a proper authorization indicator. A 
message can be forwarded to the request initiator (e.g., a postmaster at the sender) that 
the requesting agent is not corifiguring a proper request-to-send (e.g., the agent is out of 
date) and should be upgraded to cominunicate properly with the receiver. In one 

25 exemplary implementation, if the request initiator does not properly participate in 
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unsolicited e-mail internet protocol (DP) source address verification method 200 after a 
predetermined time of being warned, imsolicited e-mail internet protocol (IP) source 
address verification method 200 caii return to denying authorization to forward a 
message. 

5 

It is appreciated that the source verification and tracking features of the present 
iiivention can be utilized to also facilitate a variety of other e-mail message management 
capabilities. For example, present invention source Verification and tracking information 
can be utilized to facilitate blocking functions. In one embodiment, a determination is 

10 made if there is a reason to deny authorization and not forward a verification indicator. 
A list of unauthorized addresses can be maintained. For example, the list can include 
addresses that have previously been identified as sources associated with forwarding 
"spam''. The address of the request source (e.g., from step 110, 210, etc.) is compared to 
the list of unauthorized source identifications (e.g., IP addresses). Jf the source 

15 identification or address of the requesting device is on the list of xmauthorized sources, an 
authorization indication is hot forwarded and e-mail messages from the source are 
blocked. 

In one embodiment of the present invention, content related information included 
20 in the header is also checked in case someone illicitly obtains the authorization indicator. 
The content related information can be a short piece of information related to the e-mail 
message. For example, a hash digest of the e-mail body text or possibly select portions of 
a header other than a portion of the header designated for authorization information (e.g., 
the subject or first predetermined number of characters of the email itself). The content 
25 related information is something that can be checked against the email that eventually is 
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received to ensure it deals with the same subject matter (e.g., "matches") as indicated in 
the request. Checking the content related information helps increase security in case 
someone is listening on the line or snooping the authorization indicator and creates a 
misleading or "bogus'' e-mail with the "snooped" legitimate indicator. Underlying layers 
5 of security can be added through various other layers of callback mechanisms. 

Figure 3 A is a block diagram of a computer system 350, one embodiment of a 
computer system on which the present invention may be implemented. For example^ 
computer system 350 can be utilized to implement unsolicited electronic message source 

10 tracking method 100, unsolicited e-mail IP source address verification method 200, 

and/or tmsolicited electronic message initiation tracking method 400. Computer system 
350 includes commtinication bus 357, processor 351> memory 352, input component 353, 
bulk storage component 354 (e.g., a disk drive), network communication port 359 and 
' display module 355. Communication bus 357 is coupled to central processor 351, mernory 

15 352, input component 353, bulk storage component 354, network commurucation port 359 
and display module 355. 

The components of computer system 350 cooperatively function to provide a 
variety of functions, including performing emulation application revision in accordance 

20 with the present invention. Commimication bus 307 commxmicates information. 

Processor 351 processes information and instructions, including instructions for verifying • 
and tracking unsolicited electrbnic message source identifications. For example, the 
instructions can include determination of proper authorization and accountability 
tracking for e-mail messages. Memoiy 352 stores information and instructioris, including 

25 for instructions verifying and tracking ui\solicited electronic message source 
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identifications. Bulk storage component 354 also provides storage of information. Input 
component 353 facilitates commimication of information to computer system 350. 
- Display module 355 displays iriformation to a user. Network conra 

provides a commimication port for commtinicatively coupling with a network. 

5 

In one embodiment, the present invention is implemented on devices (a computer 
system, embedded devices, etc.) connected via a communication network. Figure 3B is a 
block diagram of communication network 300, one exemplary commimication network in 
accordance with the present invention. In one embodiment of the present invention, 

10 unsolicited e-mail authorization, source verification and tracking information are . 

communicated via comrnimications network 300. Commimicatiori network 300 comprises 
computer system 350 for implementing electronic message source verification and 
tracking, dense wave division multiplexer (DWDM) 301 and 302, optical concentrators 
. . 310, 311, 312 and 317, routers 331, 340 and 87, cellular station 315, cellular device (e.g., 

15 phone, handheld computer, etc.) 399> microwave transceiver 381, Internet 370, servers 385, 
332, 333 and 335, personal computers 337, 339, 341, 371, 382, 383, 384, 388 and 389, and 
miscellaneous communication equipment 375 and 377. The components of 
communications network 300 communicate with each other over a variety of architectures 
utilizing numerous cornmimication protocols. One exemplary implementation of ' 

20 . communications network 300 utilizes Fiber Distributed Data interface (FDDI), Dynamic 
Packet Transport (DPT), Packet Over Sonet (POS), Asynchronous Transfer Mode (ATM), 
Ethernet, token ring. Transmission Control Protocol/Internet Protocol (TCP/IP), plain old 
telephone system (POTS), Cable, Digital Subscriber Line (DSL), etc. 
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Figure 4 is a flow chart of unsolicited electronic message initiation tracking method 
400, in accordance with one embodiment of the present invention. Unsolicited electronic 
message initiation accountability tracking method 400 facilitates tracking of electronic 
message initiation. For example, the source address of "spam" irutiators can be tracked. 

In step 410> a request for permission to forward an electronic message is 
formulated. In one embodiment, a message initiator inserts an indication in a header of a 
communication packet (e.g., in a handshaking packet) that the initiator is attempting to 
establish a communication link for the purpose of forwarding a message to a particular 
destination. The initiator also includes an indication of the initiator source address (e.g., 
IP address) in the header. In one exemplary implementation, the communication link is 
broken after the request for permission is forwarded 

In step 420, the request for permission is analyzed. For example, the header of a 
communication packet is examined for an indication of a source address. If the header 
does not have a source address, permission to forward an e-mail is denied and the 
communication link is not established. In one exemplary implementation, a preliminary 
reply asking for the source address is forwarded and an opportunity is given to the 
initiating source to provide an address. 

In step 430, a permission reply is sent to the permission request source address. 
For example, the permission reply is sent to the source address identified in step 420. The 
permission reply includes a permission indicator (e.g., a unique or special sequence of 
bits). In one embodiment of the present invention, a time stamp is maintained of when a 
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permission indicator (e.g., a imique key) is generated. In one exemplary implementation, 
a second link or coimection is estaiblished to send the permission reply. 



In step 440, an electronic message (e.g., an e-mail message) is formulated and 
forwarded, including the permission indicator in the header. The header also includes an 
electronic message source address indication. In one exemplary implementation, a third 
link or connection is established to send the electronic message. 

In step 450, the electronic message of step 440 is received and the source address of 
the electronic message and the permission request source address from step 410 are 
tracked. A permission indicator in a header packet is examined for validity. If the . 
permission indicator is valid (e.g., corresponds to permission indicator included in the 
reply of step 430) the electronic message of step 440 is forwarded. In one exemplary 
implementation, if the permission indicator is not valid the commuiucation link is 
terminated. In one embodiment, ihe duration between the issuance of permission and the 
time when a message with the permission is returned is checked against a list of time 
stamps. If a predetermined duration is exceeded the message can be denied (e.g., not 
forwarded) regardless of having an otherwise valid permission indicator. 

Thus, the present invention imsolicited e-mail authorization method and system 
provides an efficient and convenient imsolicited electronic messages (e.g., e-mails) source 
verification and tracking mechanism. The imsolicited e-mail authorization method and 
system facilitates verifiable identification of unwanted e-maU (e.g. "Spam") sender and 
eases e-mail management activities. A source address forwarding unsolicited e-mail is 
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identified and tracked, permitting accountability and responsibility for forwarding the e- 
mail to be assigned to the source address. 

The foregoing descriptions of specific embodiments of the present invention have 
5 been presented for purposes of illustration and description. They are not intended to be 
exhaustive or to limit the invention to the precise forms disclosed, and obviously many 
modifications and variations are possible in light of the above teaching. The 
embodiments were chosen and described in order to best explain the principles' of the 
invention and its practical application, to thereby enable others skilled in the art to best 
10 utilize the invention and various embodiments with various modifications as are suited to 
the particular use contemplated. It is intended that the scope of the invention be defined 
by tiie Claims appended hereto and their equivalents. 
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